coding-agent
Fail
Audited by Socket on Feb 28, 2026
1 alert found:
MalwareMalwareSKILL.md
HIGHMalwareHIGH
SKILL.md
The manifest serves as a legitimate orchestration guide for automating coding agents via PTY-enabled Bash sessions. It appropriately documents workflow patterns (background tasks, git worktrees, PR interactions) but includes high-risk automation options (e.g., --yolo) that warrant careful governance. No direct malicious payload is evident within the fragment; the main concern is the potential surface area created by automated, long-running interactions with local repos and remote services. Recommend implementing strict session isolation, input validation, minimal logging, and auditing for any automated workflows derived from this manifest.
Confidence: 95%Severity: 90%
Audit Metadata